Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:107872
MIME-Version: 1.0
References: <CAAupm8h5Aa4EmnGnHX1iVgcQTCpmW-3yD4e6m7aouZFiSCtGrA@mail.gmail.com>
 <05388310-2c80-2b42-a564-0fda2b6a2396@gmail.com> <CAAupm8gDxAjiW0Ox7jWAC0fEKUwSwYPA27NjHUawTVFd8RDc1w@mail.gmail.com>
In-Reply-To: <CAAupm8gDxAjiW0Ox7jWAC0fEKUwSwYPA27NjHUawTVFd8RDc1w@mail.gmail.com>
Date: Wed, 27 Nov 2019 00:09:18 +0100
Message-ID: <CAG9XoMRf9kEQ2xFOZ_jVxmdxgg3qa4e5iyDc9ZN2rN2C3UktRg@mail.gmail.com>
To: Ian Littman <iansltx@gmail.com>
Cc: Stanislav Malyshev <smalyshev@gmail.com>, PHP internals <internals@lists.php.net>
Content-Type: multipart/alternative; boundary="000000000000f487df059847f8cd"
Subject: Re: [PHP-DEV] Let's allow eval() to be turned off in PHP 8
From: benjamin.morel@gmail.com (Benjamin Morel)

--000000000000f487df059847f8cd
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

>
> One interesting thing with item #1 is that it allows for remote arbitrary
> code execution even if no include-able path on a server is writable. This
> comes into play if there's a supply chain attack on your app. Say, an
> infected update on a CMS plugin. Get an eval() of a file_get_contents() o=
f
> a URL into the code and...well, you get code execution that (if you're
> lucky) only leaves a trace in logs. If you have to write a file somewhere
> first, then include it, you've got a bit more of a footprint.



You don't have to hit disk, or have any writable path. You can just create
a stream wrapper <https://www.php.net/manual/en/class.streamwrapper.php>
that stores the "files" in memory, and include them as you would include a
regular file.


Can you work around these restrictions? Yep, but it takes a bit more effort
> than the current setup. It doesn't make a server secure by any stretch, b=
ut
> it reduces its attack surface slightly, and reduces the universe of
> malicious code that won't error out, forcing malefactors to work just a b=
it
> harder.



Disabling eval() really doesn't reduce the attack surface at all, if you
ask me. Malefactors will quickly & easily adapt their tools, that script
kiddies will use as before.


=E2=80=94 Benjamin

--000000000000f487df059847f8cd--